I really dislike the upgrade game. If a system is stable and doing the things I want, then I am of a mind to leave the system be.
The problem is that some upgrades include patches for known security holes. Known security holes get passed around between hackers. That means that I am stuck playing the absurd upgrade game.
If the upgrade is for security then there has to be a serious consideration, yes. To me, it is all about how much risk a business is willing to take on and how much they are willing to assume for their customers and up and down the supply chain as well. Well-established policy and the process will help in this decision-making.